An agent pursuing a goal should learn which actions are possible before executing them. Constraint-aware planning queries authorization policy early, incorporates the resulting constraints into strategy selection, and avoids discovering boundaries only through failed requests. section 18.4
Avoiding restricted credential files
A reactive agent may probe several paths to restricted credential files, receiving repeated denials and revising its plan after each failure. A constraint-aware agent queries policy first, recognizes that the operation is prohibited, and avoids generating the request. section 18.4.3
The technique changes authorization from a passive boundary into planning guidance:
- Policy systems can return residual constraints from partial requests, allowing agents to shape plans before execution. section 18.4
- Across domains, downstream resources can advertise permitted and prohibited operations so upstream agents fit their plans to layered authorization boundaries. section 18.7
- This reduces invalid exploration, unnecessary requests, and risky attempts while preserving policy enforcement at the resource that owns the decision. section 18.4.3 section 18.7
Figure 18.5 Cross-domain delegation in a society of agents. Two policy-limited agents collaborate across domains. The receiving agent makes promises about its future behavior, and the requesting agent assesses those promises and the partner’s reputation and then grants authority using a credential. The receiving agent operates under its own policies, and both domains log the outcome for future decisions.
A cross-domain delegation diagram shows how policy-limited agents exchange promises and credentials while each domain retains its own authorization policies and logs. section 18.7
